Back Darkreading

Ransomware Gangs Embrace Physical Threats, Family Stalking?

Darkreading • October 14, 2026

Organizations are reporting that employees face threats to their families, stalking, physical violence, and abduction. But these alarming claims are hard to verify.

Ransomware actors have been threatening their victims with physical violence, according to new survey data. Many are reporting actual physical attacks being carried out in service of ransomware extortions, though hard data substantiating these claims is missing.

A combined two out of every five organizations that participated in Semperis's newly released 2026 Ransomware Risk Report indicated they had faced intimidation and threats associated with their ransomware attacks, and often severe ones. Even more remarkably, more than half of respondents claimed that attackers "carried through on threats" they made.

Semperis's study relied on self-reporting, and it couldn't corroborate these alarming figures, nor could Dark Reading. If true, the data suggests that ransomware is escaping the digital realm and becoming a genuine risk to victims' safety . Unless and until proven cases of violent attacks surface, however, the data must be met with caution.

Related: AI Scramble Drives Cybersecurity M&A Boom

Orgs Say Employees Are Being Assaulted

It was last year when the realization first hit: Semperis started asking survey participants physical threats to their organizations in its 2025 annual report, and a full 40% of participants said yes, they had received such threats from their hackers.

This year's data casts some confusion around the matter, as only 17% of 2026 respondents told surveyors that they'd been subject to physical threats. A further 23% reported psychological intimidation.

Among personal threats, threatening texts, letters, or packages (57% of those who reported being threatened in the first place) were most commonly experienced. Attackers also went much further, though, by threatening employees' family and friends (37%), physical intrusion into an organization's facilities (19%), abduction (17%), bodily harm (13%), and stalking (6%).

Worst of all, perhaps, is that 53% of survey respondents reported that their attackers actually carried out their threats.

Interestingly, these figures varied significantly between countries and industry verticals. In the UK, Semperis found that around 34% of ransomware groups' threats were carried out, and that victims might expect to be stalked 18% of the time. Hackers operating in Italy are exceptionally violent, apparently, as 32% of victims there were threatened with abduction and 22% with bodily harm, with 74% claiming that their threats were carried out.

Attackers have been finding other ways to make ransomware personal issues for their victims, too. According to Semperis, victims or their families were doxxed, swatted, or subjected to some other sort of public shaming in more than half of all cases.

Related: Device Code Phishing Up 1,500% in 2026; Vishing Doubles

Are Threat Actors Actually Physically Harming People?

Asked whether ransomware victims are actually being physically harmed, Jeff Wichman, Semperis’s director of incident response, states, "Yes. In some way, shape, or form, it does happen."

In reporting this story, however, Dark Reading failed to find even a single documented case of violence perpetrated in service of a ransomware attack. Asked for a case study, Semperis pointed to a Europol press release regarding so-called " violence-as-a-service ," but Europol did not connect violence-as-a-service with ransomware. However, there is hard evidence that violence in cyberattacks exists in related ways.

First, physical violence is rife and increasing around cryptocurrency thefts . Back in February, Web3 security company CertiK Skynet published its annual report on so-called " wrench attacks ." As the name implies, "wrench attack" is the cryptocurrency world's term to describe when attackers physically assault their targets in order to steal their cryptocurrency wallet private keys. CertiK Skynet documented 72 cases in 2025, which represented a 75% rise over 2024. Chainalysis found a similar " surge " of wrench attacks in 2025. Halfway through 2026, it found that violent attackers had successfully won $30 million worth of crypto.

Related: Stronger AI Safety Requires Peeking Inside the 'Black Box'

What's true of cryptocurrency is not necessarily true of enterprise cyberattacks, of course. But cyber extortion groups do appear to dabble in physical intrusion. In spring 2026, the FBI and Mandiant researchers each documented the "Silent Ransom Group" posing as IT technicians to enter corporate offices and extract data from endpoints using USBs.

Lastly, it does seem the case that threats of violence are rising across online attacks generally (if not ransomware specifically). In its Internet Crime Report 2025 , the FBI reported having received 1,360 complaints involving threats of violence, in cases that did not involve extortion. In 2025 it received 4,826 — a 250% rise year over year.

Why Hackers Turn to Physical Threats

Semperis has had firsthand experience with ransomware groups' threats. A few years ago, while representing a US government organization in a ransom negotiation, one of its own employees received a package on his doorstep with a note "alluding to physical violence if he didn't back off," the BBC reported.

Ironically, a rise in physical threats could be interpreted as a byproduct of improved organizational cybersecurity. "As attackers lose leverage with [extortion] — companies now are in the position of 'we've got this and this covering us' — now it's more forcing that demand. 'You need to talk to us. We are serious,'" Wichman says.

"It will keep evolving just like anything else," he continues. "I look at it kind of like the days of the mafia. Originally, it was just extorting money from businesses. Then it became: You didn't pay us, now we're going to get violent. Same old, same old."

Nate Nelson is a journalist and award-winning scriptwriter. In addition to Dark Reading he writes for Darknet Diaries, the most popular show in cybersecurity across all media.

He began his career as a freelancer, ghostwriting Forbes and CNBC op-eds for executives in tech and finance. Then he transitioned to journalism at Threatpost, where he covered cybersecurity news and trends. Throughout those years he co-created a cybersecurity podcast, Malicious Life, which in its day climbed into the Top 20 technology podcasts charts on Apple Podcasts and Spotify.

He holds degrees from New York University and Bard College. As a born and bred New Yorker, he enjoys a superiority complex, but is polite enough to keep it to himself.

Want more Dark Reading stories in your Google results?

The State of Cloud Security: The Latest Challenges

How Organizations Are Managing Incident Response

How Enterprises Are Developing Secure Applications

Inside RSAC 2026: security leaders reveal the risks redefining your defense strategy

Essential News & Insights from Black Hat USA 2025

How to Harness your Security Operations Data for Enterprise Defense

Building Cyber Resilience: Beyond Prevention to Recovery

The Frontier AI Threat: Closing the Mobile Gap in Your Exposure Management Strategy

Static Analysis, Smarter Triage, Agentic Depth: A Practical AppSec Stack for AI-Driven Development

Effective Alert Triage: Reducing Noise and Finding Real Threats

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ransomware Threats Escalate to Physical Violence Against Victims A recent report from Semperis indicates a troubling trend in ransomware attacks, where physical threats against employees and their families have become more common. In 2026, 40% of organizations reported experiencing psychological or physical threats from ransomware actors, with 53% of those threats being carried out. The study highlights that attackers are increasingly using AI in their operations, with 87% of attacks involving weaponized artificial intelligence. The report also notes a significant rise in data theft, with ransomware groups exfiltrating over 896.2 terabytes of data, a 275% increase from previous years. The findings suggest that ransomware is evolving beyond digital extortion to pose real risks to victims' safety. However, the data is based on self-reported surveys, making verification difficult. The report covers responses from organizations in multiple countries, including the U.S., UK, and Italy. 10 sources 65

Extracted Entities

Ransomware Gangs Embrace Physical Threats, Family Stalking?

The full story

Extracted Entities

Attack Types (1)

Countries (1)

Ransomware Groups (1)